Menu

General notice to cover adult social care and health

We keep this privacy notice under regular review and was last updated on 14 July 2026.

We respect your privacy and is committed to protecting your personal data. This privacy notice will inform you as to how we look after your personal data and tell you about your privacy rights and how the law protects you.

View an easy read version of the general notice (PDF, 509.4 KB).

Who we are

We collect, use and are responsible for certain personal information about you. When we do so we are regulated under the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are responsible as ‘controller’ of that personal information. Our Data Protection Officer is Benjamin Watts.

Kent Adult Social Care and Health will work with you to promote the health and wellbeing of all persons, designing services together that both suit and meet needs by working with you or a member of your support network (other people or organisations who are involved in your care and support, such as a family member, advocate, health professional).

We are responsible for assessing and supporting social care needs and are split into three areas. This includes:

  • short term support, for example, early intervention and enablement support
  • long term support, for example, assessing care needs and safeguarding work
  • commissioning and partnerships, for example, planning and commissioning of services.

Key national legislation and policies drives the duties and functions we undertake. For example, the Care Act 2014 allows us to assess and deliver care and support planning. The Mental Capacity Act 2005 sets out the principles and procedures to follow where a person does not have capacity to make decisions. The Mental Health Act 2025 places obligations to provide mental health assessments. Other legislation and policies include the Health and Social Care Act 2022, the Human Rights Act 1998, CQC Local Authority Assessment.

This privacy notice focuses on the short and long term support teams who provide care and support and services to adults. There are separate privacy notices for specific aspects of care, support or services provided.

The personal information we collect and use

Information collected by us

In the course of working with you, or someone from your support network, we may collect personal information when you, or someone from your support network, provides it to us. We may collect

  • personal details and demographics, such as your name, address, date of birth and/or age, sex, NHS number
  • contact details, such as postal address, telephone number, email address and contact preferences
  • financial information, such as bank and income details, types of benefits being received or in the process of being received, national insurance number, debts
  • legal statuses, such as power of attorney, guardianship, next of kin details to establish who we are able to liaise with to provide the right care and support to you at the right time and the person’s background to understand their relationship to you.

We also collect ‘special category data’ (personal data which is more sensitive and is treated with extra care and protection) when you, or someone from your support network, provides it to us. We may collect:

  • your racial or ethnic origin, religious or philosophical belief and your sexual orientation
  • health conditions such as relevant information on medical records, disabilities or carers responsibilities that may apply to you
  • photographs of yourself or your environment to help inform assessments, for example, for occupational therapy
  • details of referrals made for you by you or by someone who may be involved in your care and support
  • your circumstances, needs and wishes
  • relevant health and safety concerns.

We may collect criminal offence data when you, or someone from your support network, provides it to us. We may collect data about:

  • allegations
  • investigations and proceedings
  • criminal activity and unproven allegations
  • penalties, restrictions or conditions, civil measures.

Criminal offence information may need to be disclosed and shared when providing care and support or services to you, to ensure that you are provided with the right care and support at the right time and to ensure your and other people’s safety. This will only be shared in very narrow circumstances and would be on a strictly need to know basis.

Where someone from your support network provides your personal data to us, we will also collect personal data about them, which includes:

  • their name, relationship to you (for example, family member, GP) and any legal statuses (power of attorney, guardianship, next of kin)
  • their contact details e.g., postal address, telephone number, email address and contact preferences
  • any health conditions, disabilities, carer responsibilities.
  • their circumstances and general background, needs and wishes, relevant health and safety concerns
  • any safeguarding concerns or information detailed in the safeguarding referral form if they are the referrer. We will do our best, where possible, for the referrer to remain anonymous
  • information disclosed in a best interests, safeguarding or professionals meeting to ensure the right care and support is in place for an individual
  • any criminal offence data, as listed above, where applicable
  • additional information provided in referral forms, for example safeguarding.

If someone from your support network is a professional (for example, health professional), we will also collect their organisational details (such as job title, team name) and their contact details and contact preferences.

How we use your personal information

We use your personal information to:

  • create and maintain a secure record of you, your information and the care, support or services that have been provided or are being arranged for you
  • create and undertake assessments and plans to help fully understand your needs and the care, support or services that need to be implemented
  • arrange and provide short or long term support, and respite care packages based on support required. This includes the installation of specialist equipment or assistive technology
  • assess your financial contribution to your care, support or services and complete a means tested financial assessment to calculate the contribution of cost to your care and support. This will use automated decision making; the financial assessment will be reviewed annually and an uplift in the calculation contribution is made. This will reflect expected changes in allowance benefits, capital and income
  • work with other organisations involved in your care and support and help support with referrals or applications where applicable
  • work with other local authorities to assist with out of area placements to ensure care and support is provided, where required
  • keep you and others safe from harm and to promote your mental health and wellbeing
  • support the delivery of the digital switchover by working with Telecare and telecoms providers to identify individuals who have ancillary services in place to help minimise the effect that the digital switchover will have
  • inform our response to incidents and major emergencies, working in collaboration with multi-agency partners to protect your safety and support the response to an emergency, outbreak or pandemic, and identify who may be vulnerable and at risk. This may include processing personal information for individuals who do not meet our normal support criteria
  • contribute to the delivery of shared care records, such as Kent and Medway Care Record
  • support the submission of statutory government data collections, such as Client Level Dataset
  • support the function of the Care Quality Commission to inspect Local Authority care in their area
  • process feedback, compliments or complaints regarding the care, support or services that have been provided and inform outcomes to a grievance, resolution or disciplinary process
  • process survey responses in relation to local feedback gathering or mandatory national surveys
  • ensure system maintenance and training to support with creating and maintaining secure records of you and the care, support and services that have been provided
  • build performance statistics on trends, patterns, key performance indicators to help determine demand on services, and where care and support is required and to identify savings
  • work with service improvement consultants to ensure that Adult Social Care can deliver sustainable care and support, identify service improvements and best practice and standards
  • support the implementation of the Local Government Reorganisation for Kent to provide continuous care and support and services to individuals.

Reasons we can collect and use your personal information

When we collect your personal data, we rely on the following legal bases:

  • Article 6(1)(a) - the individual has given clear consent for you to process their personal data for a specific purpose.
  • Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Article 6(1)(d) - processing is necessary to protect someone’s life (vital interests).
  • Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

When we collect your ‘special categories of personal data’, (such as health, race, ethnicity, sexual orientation) we rely on the following legal bases:

  • Article (9)(2)(a) - the individual has given explicit consent to the processing of those personal data for one or more specified purposes.
  • Article (9)(2)(c) - it is necessary for the protection of vital interests.
  • Article (9)(2)(g) - processing is necessary for reasons of substantial public interest.
  • Article (9)(2)(h) - processing is necessary for the provision of health or social care or treatment or the management of health or social care systems and services.
  • Article 9(2)(i) - Necessary for reasons of public interest in the area of public health (subject to a DPA 18 condition.
  • Article 9(2)(j) - Necessary for archiving purposes in the public interest, scientific, or historical research purposes in accordance with Article 89(1) (subject to a DPA 18 condition) which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

We rely on the safeguarding of children and of individuals at risk and statutory and government purposes from Schedule 1 of the Data Protection Act 2018 when relying on Article (9)(2)(g) to process your special category data.

We rely on the public interest, health or social care purpose and research conditions from Schedule 1 of the Data Protection Act 2018 when relying on Article(9)(2)(h) to process your special category data.

We rely on the extension to substantial public interest condition from Schedule 1 of the Data Protection Act 2018 to process your criminal convictions and offence data.

We take the following appropriate safeguards in respect of your special category data and your criminal conviction or offence data when relying on the conditions above. We:

  • have an Appropriate Policy for Lawful Processing which explains how the data protection principles are secured when using special category information. This policy is retained throughout the time we use your data and for six months after we cease to use it.
  • have a retention schedule which explains how long data is retained.
  • maintain a record of our processing in our Record of Processing Activities and record for any reasons deviating from the periods in our retention schedule.

Where we have a statutory basis for collecting your personal data, we do not need to ask for your permission to collect and share it, however we will only ever share your data on a basis of need, in line with legislation and will work transparently with you at all times.

If you do not provide your data, it will limit the effectiveness of the services and support that we are able to offer you.

How long your personal data will be kept

We will only hold your personal information for as long as necessary. Our retention periods can be viewed in our retention schedule (see sections AS1 – 6 (excluding AS2.1, AS2.2, AS4.4, AS4.5, AS4.11, AS4.12.14 to AS.12.16, AS4.13, AS5.2, AS6.1, AS6.4 to AS6.6 and EM1.1.7, EM1.1.9 to EM1.1.10). The criteria for determining retention periods are statutory or other industry requirements, legal liability or other legal requirements and best business practice.

Any updates or changes or new entries to our retention schedule are updated on a quarterly basis, and therefore, the current version linked above, may not list the most up to date retention periods until the next publication.

Where your personal information is shared with other organisations or people involved in your care and support, this will be held in-line with their retention schedules and policies.

Who we share your personal information with

In the course of working with you, or someone on your behalf, we may collect personal data from, or share it, with the following third-parties, where relevant. This is a non-exhaustive list and sharing personal data is dependent on your needs.

  • NHS, for example, GP’s, Acute Trusts, Accident and Emergency departments, Kent and Medway Mental Health NHS Trust (previously KMPT), Kent Community Health NHS Foundation Trust.
  • NHS Summary Care Records (for allergens or dietary requirements if you are staying at a short break service).
  • Partner agencies, such as voluntary or statutory organisations.
  • Other professionals involved in your care, support or services.
  • Other people involved in your care, support or services, for example, next of kin, advocate, legal representative, family members, carers.
  • External providers to signpost or support with referrals or applications where applicable and commissioned service providers, such as care homes.
  • Internal teams, such as Financial Assessment and Income team.
  • District and borough councils, schools or other local authorities.
  • Housing associations and landlords.
  • Kent and Medway Safeguarding Adults Board, Kent Safeguarding Multi-agency Partnership.
  • Government departments and teams, for example, Department for Work and Pensions, Government Digital Service, Department of Health and Social Care (NHS England) and regulators such as Care Quality Commission.
  • Cabinet members, county councillors, MPs, Local Government Ombudsman.
  • Utility network operators (for example, gas, electric).
  • Telecare and telecoms providers.
  • Kent and Medway Care Record partner organisations.
  • Service improvement consultants.

Each organisation listed above will ensure they have the relevant agreements in place to be able to process your personal information.

Sharing your personal data enables us to personalise your care and ensure that you are receiving the best care, support and services possible and facilitates a joined up approach with other organisations or people involved in your care and support.

We will share personal information with law enforcement or other authorities if required by applicable law or in connection with legal proceedings.

We will share personal information with our legal and professional advisers in the event of a dispute, complaint or claim. We rely on Article 9(2)(f) where the processing of special category data is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.

NHS and care services

We have processes in place for considering requests for data disclosures for purposes beyond direct care which is consistent with national data opt-out policy. Our organisation is compliant with the national data opt-out policy.

To find out more about the NHS’ wider use of confidential personal information and to register your choice to opt out if you do not want your data to be used in this way, visit the NHS website. If you do choose to opt out you can still consent to your data being used for specific purposes.

Your rights

Under the UK GDPR you have rights which you can exercise free of charge which allow you to:

  • know what we are doing with your information and why we are doing it
  • ask to see what information we hold about you (subject access request)
  • ask us to correct any mistakes in the information we hold about you
  • object to direct marketing
  • make a complaint to the Information Commissioner's Office

Depending on our reason for using your information you may also be entitled to:

  • ask us to delete information we hold about you
  • have your information transferred electronically to yourself or to another organisation
  • object to decisions being made that significantly affect you
  • object to how we are using your information
  • stop us using your information in certain ways

We will always seek to comply with your request however we may be required to hold or use your information to comply with legal duties. Please note, your request may delay or prevent us delivering a service to you.

For further information about your rights, including the circumstances in which they apply, see the guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights under the United Kingdom General Data Protection Regulation.

If you would like to exercise a right, please contact the Information Resilience and Transparency Team at data.protection@kent.gov.uk .

Keeping your personal information secure

We have appropriate security measures in place to prevent personal information from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Who to contact

Contact the Information Resilience and Transparency Team at data.protection@kent.gov.uk to exercise any of your rights, or if you have a complaint about why your information has been collected, how it has been used or how long we have kept it for.

Contact our Data Protection Officer, Benjamin Watts, at dpo@kent.gov.uk .

UK GDPR also gives you right to lodge a complaint with Information Commissioner, who may be contacted via the Information Commissioner's website or call 03031 231113.

For further information read our privacy statement.